df2f74d2081791ae39d47e9acf7c2f62c7df4317548307b3f3588419da5dce4e

Analysis

max time kernel
118s
max time network
135s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21-10-2023 21:14

Target

NEAS.18326d12b6c95a7cbf56befabf8b0a20.exe
Size

307KB
MD5

18326d12b6c95a7cbf56befabf8b0a20
SHA1

4b74355babfac31999fdfd7cefd79939abe9d0ee
SHA256

df2f74d2081791ae39d47e9acf7c2f62c7df4317548307b3f3588419da5dce4e
SHA512

a889f3c9ac0f11a2bed51b2c373346aa9a43a221dd7d6da51f0bf0c2250178e7dbbde077306b89715b03faa55e4cb420b53887dea5c11b620ff640be394ff525
SSDEEP

768:s0jnjwtp5tj6+Zg3cmLMnP9vSOLoFjsJEI+MDiRZDiRuTtrDiRs7TsDiRb:nEt9W+Zg3fM5LujsJEKsNrtcA

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1436	2000	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1436	2000	NEAS.18326d12b6c95a7cbf56befabf8b0a20.exe	28
PID 2000 wrote to memory of 1436	2000	NEAS.18326d12b6c95a7cbf56befabf8b0a20.exe	28
PID 2000 wrote to memory of 1436	2000	NEAS.18326d12b6c95a7cbf56befabf8b0a20.exe	28
PID 2000 wrote to memory of 1436	2000	NEAS.18326d12b6c95a7cbf56befabf8b0a20.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.18326d12b6c95a7cbf56befabf8b0a20.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.18326d12b6c95a7cbf56befabf8b0a20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 560
  2⤵
  - Program crash
  PID:1436

memory/2000-0-0x00000000008C0000-0x0000000000912000-memory.dmp

Filesize
328KB

Download
memory/2000-1-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download
memory/2000-2-0x0000000074B50000-0x000000007523E000-memory.dmp

Filesize
6.9MB

Download